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SATELLITE GN&C ANOMALY TRENDS 


Brent Robertson*, Eric Stoneking* 


On-orbit anomaly records for satellites launched from 1990 
through 2001 are reviewed to determine recent trends of un- 
manned space mission critical failures. Anomalies categorized by 
subsystems show that Guidance, Navigation and Control (GN&C) 
subsystems have a high number of anomalies that result in a 
mission critical failure when compared to other subsystems. A 
mission critical failure is defined as a premature loss of a satellite 
or loss of its ability to perform its primary mission during its 
design life. The majority of anomalies are shown to occur early in 
the mission, usually within one year from launch. GN&C 
anomalies are categorized by cause and equipment type involved. 

A statistical analysis of the data is presented for all anomalies 
compared with the GN&C anomalies for various mission types, 
orbits and time periods. Conclusions and recommendations are 
presented for improving mission success and reliability. 

INTRODUCTION 

A study of past on-orbit anomalies was undertaken to assess how fixture satellite 
program resources might be best spent to ensure mission success. The requirements for 
fixture spacecraft include advances in reliability, particularly for deep space missions and 
long duration Earth observing platforms. The American industry has typically tried to 
achieve this goal by incorporating redundancy, robustness and fault tolerance in 
spacecraft designs, and verifying those designs with a thorough test program. This 
approach has had varying degrees of success; it is not clear whether the benefit outweighs 
the cost for all cases. Although Launch Vehicle failures have contributed to the majority 
of past space mission losses, this trend may be changing; in 1998 the bulk of satellite 
losses were caused by failures of on-orbit satellites. In the last four years, space 
insurance rates for Geosynchronous Earth Orbit (GEO) commercial communications 
satellites has risen by 129% and major on-orbit anomalies have risen by 146% 1 . Analysis 
of on-orbit anomalies can provide greater insight into design and process improvements 
and help in devising more effective verification methods during integration and test. 
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Mission critical on-orbit anomalies were analyzed to determine the number and 
characteristics of mishaps. A mission critical failure is defined as a premature loss of a 
satellite or loss of its ability to perform its primary mission during its design life. On- 
orbit anomaly data used in this study was taken from a number of sources in the public 
record. Data was taken from databases available on the web including The Satellite 
Encyclopedia (TSE) 2 , Satellite News Digest 3 , Mission and Spacecraft Library 4 , Airclaims 
Space Trak 5 , and Encyclopedia Astronautica 6 . Data was also taken from the Space 
Systems Engineering Database 7 (SSED) and the Mission Failure Analysis for NASA 
Ames Research Center 8 . All anomaly reports collected were unclassified, and almost all 
were written, archived and reference-able. Wherever possible, records of anomalies were 
corroborated between multiple sources. Anomalies associated with Guidance, 

Navigation and Control (GN&C) were scrutinized further, with every attempt made to 
obtain mishap reports, visit pertinent web sites, or to contact people with insight into the 
problem. A statistical analysis of the data was undertaken for all anomalies compared 
with GN&C anomalies, for various mission types, orbits and time periods. 

In this study, GN&C is defined as including the on-orbit Attitude Control System 
(ACS), the on-orbit Propulsion System and all ground operations and software associated 
with satellite flight dynamics (trajectory planning and determination, navigation and 
attitude determination). 

DATA COLLECTION 

Table 1 contains the satellite classifications and categories used for analysis of 
anomaly trends. Only on-orbit anomalies involving un-manned spacecraft were 
investigated; launch and upper stage failures were not recorded. Anomalies were 
investigated for all on-orbit satellites launched in the years 1990 through 2001. The 
analysis only investigated satellites that were designed and built by companies or 
government organizations in the United States, Europe, Canada or Japan. An anomaly 
was recorded only if it occurred prior to the mission fulfilling its design life. Anomalies 
that occur during an extended mission were not recorded. 


Table 1 Anomaly Classification 


Classification 

Category 

Satellite 

Name 

Mission 

Space Science, Earth Science, Deep Space, Communications, Military, Technology, 
Other 

Orbit 

Low Earth Orbit (LEO), High Earth Orbit (HEO), Geosynchronous Earth Orbit 
(GEO), Heliocentric, Planetary 

Launch Date 

1990 through 2001 

iggggaM 




Impact 

Total Loss, Partial Loss, Mission Interruption, Shortened Life, Performance Loss 

Failure Subsystem 

Attitude Control System, Propulsion, Electrical Power System, Command & Data 
Handling, Mechanical, Software, Payload, Operations, Unknown 
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Missions were categorized as space science (including astronomy and observation 
of the Sun,) Earth science (including meteorology, remote sensing, observations of the 
Earth atmosphere, ionosphere and magnetosphere, and geodesy), deep space (Mars, 

Lunar and asteroids), communications (including telecommunications and Direct TV), 
military, technology, and other (including test, burial, materials processing and biology). 

Orbits were categorized as Low Earth Orbit (LEO), High Earth Orbit (HEO), 
GEO, heliocentric, and planetary. LEO orbits were defined as Earth centered orbits 
having apogee and perigee less than 1500 km. HEO orbits were defined as Earth 
centered orbits with either apogee or perigee greater than 1500 km. 

The anomaly date is defined as the date that the anomaly first occurred. In some 
cases, a failure can take a significant time period to fully affect the mission. In general, 
the date of first occurrence of the anomaly was recorded. 

The impact was categorized as total loss, partial loss, mission interruption, 
shortened life, or performance loss. In general, an anomaly was recorded if an insurance 
claim was paid. A total loss resulted if a satellite failed so that it could no longer 
perform the mission, or if it was taken out of service due to an anomaly. A shortened life 
is equivalent to a total loss, although the loss has not yet occurred. The analysis did not 
include anomalies that resulted in loss of redundancy, or a minor interruption in the 
mission due to an operational work-around or software patching. Anomalies that 
occurred within the satellite operational checkout phase were not recorded unless they 
had an effect on the ability to perform the subsequent mission. 

The subsystem categories were made up of ACS, Propulsion, Electrical Power 
Subsystem (EPS), Command & Data Handling (C&DH), mechanical, software, payload, 
operations, and unknown. Mechanical was assumed to include structures, mechanisms 
and thermal. ACS was assumed to include all sensor, actuator, and ACS software 
involved with on-board attitude and orbit control. GN&C was assumed to include ACS, 
propulsion and all ground operations and software involved with flight dynamics. A 
number of recent anomalies have been associated with crystalline growth on tin relays 
that short circuit the spacecraft processor; these were categorized as C&DH. EPS 
anomalies included solar array, battery, bearing and power transfer assembly, DC-DC 
converter and power regulator problems. Transponder anomalies on communications 
satellites were categorized as payload anomalies. 

All of the GN&C anomalies were scrutinized further. Table 2 illustrates data that 
was collected for GN&C anomalies, in order to discern trends specific to GN&C 
anomalies. GN&C anomalies were categorized as caused by problems in design, 
hardware, software, verification, operations or the environment. Design includes analysis 
and models, processes or misapplication of hardware. The design category was applied 
at the system level; problems with design of component typically procured (e.g., reaction 
wheels, gyros) were categorized as hardware. The hardware category includes materials, 
parts, workmanship and design of components. The verification category was applied 
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where the test effort should have caught the design or process error (e.g. ACS polarity 
errors not found in test). The environment category was applied where on-orbit events 
such as magnetic storms caused the anomaly. 


Table 2 GN&C Anomaly Classification 


Classification 

Category 

Cause 

Design, Hardware, Software, Verification, Operations, Environment 

Equipment Type 

Wheel, Gyro, GPS Receiver, Earth Sensor, Thruster, Tank, Pyrovalve 


The GN&C equipment category includes wheel (reaction wheel or momentum 
wheel), gyro, GPS Receiver, Earth sensor, thruster, tank (fuel tank or pressurant tank), 
and pyrovalve. The equipment did not necessarily have to fail, but was at a minimum 
involved in the anomaly (e.g. a pyrovalve was fired that induced a propulsion system 
explosion), or the equipment failure caused the anomaly (e.g. the second of four reaction 
wheels failed causing the mission to be interrupted for a significant amount of time). 

To the extent possible, the subjectivity of anomaly reports was removed to 
prevent bias in analysis results. Multiple sources were used wherever possible to 
corroborate events. Every GN&C anomaly was scrutinized by each of the two authors to 
ensure consistency of reporting. Despite these precautionary efforts, a bias in analysis 
results does exist. The accuracy of anomaly reports has a direct bearing on the trends 
observed. Many anomalies are not reported in the public domain, particularly those 
involving military missions. Satellite insurance claims are not highly publicized due to 
their proprietary nature. The probability that an anomaly is reported can depend on the 
severity of the anomaly (i.e. a greater percentage anomalies causing total loss are 
reported than those causing performance loss). Many other anomalies are reported, but 
the details are scarce or the cause of the anomaly is not reported. Being employed by 
NASA, the authors have greater insight into anomalies on NASA missions than 
anomalies on other types of missions. In some cases the impact of the anomaly is 
diminished by the reporting organization. Anomalies were recorded only if they occurred 
within the satellite design life; the reported design life of a satellite can be subjective. It 
was assumed that the mission started as soon as the satellite was launched. No value was 
placed on any of the satellites or the severity of the anomalies. An anomaly that resulted 
in the loss of a half billion-dollar asset was counted the same as an anomaly that resulted 
in a University-built micro-satellite. The impact of an anomaly can be a matter of luck; 
an ACS polarity problem can result in total loss of mission (which would be recorded) or 
result in the ground catching and uploading software to fix the problem (where it would 
not be recorded). Finally, the interpretation of an anomaly report and the resulting 
categorization can be subjective. 

DATA ANALYSIS 

Figures 1 , 2 and 3 illustrate the total number of on-orbit satellites investigated in 
this study. Every on-orbit satellite that originated from the United States, Europe, 

Canada or Japan is shown by year launched from 1990 through 2001, mission type and 
orbit. Satellites that were not placed in the proper orbit by the Launch Vehicle or Upper 
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Stage were not recorded. A total of 764 satellites were recorded. It can be seen from 
Figure 1 that the launch rate for those satellites investigated peaked in 1998, mostly due 
to the launch of many LEO communication satellites during that time. Figure 2 shows 
that the majority of satellites launched were communication satellites, followed by those 
designed for military purposes. Figure 3 shows that the majority of satellites were 
launched into LEO orbits, with GEO orbits receiving the next largest number of launches. 
Very few missions were launched into heliocentric or planetary orbits. 


1990 - 2001 On-Orbit Satellites 
(US, Europe, Canada, Japan) 
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Figure 1 On-Orbit Satellites vs. Year Launched 


1990-2001 On-Orbit Satellites 
(US, Europe, Canada, Japan) 



Figure 2 On-Orbit Satellites vs. Mission Type 
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Figure 3 On-Orbit Satellites vs. Orbit 

Figure 4 illustrates on-orbit satellite anomalies recorded for satellite launched 
from 1990 through 2001 relative to the distribution by satellite subsystem. All anomalies 
are shown, as well as those that resulted in total mission loss. It can be seen that payload, 
EPS and ACS have a large contribution to reported anomalies. A total of 35 GN&C 
(ACS, propulsion, and ground operations and software involving flight dynamics) 
anomalies were reported during the time period investigated, which represents 29% of all 
anomalies recorded. The GN&C contribution to anomalies that result in total loss is 
higher, with 13 GN&C anomalies reported representing 38% of all anomalies resulting in 
total loss. 




Table 3 lists those GN&C anomalies recorded for satellite launched from 1990 
through 2001. 
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Table 3 GN&C Anomalies 


Satellite 

Launch Date 

Mishap 

Date 

Impact 

Cause 

Acrimsat 

12/20/1999 

9/1/2000 

Performance Loss 

Pointing problems 

Anik E2 

4/5/1991 

1/20/1994 

Mission Interruption 

Magnetic storm destroyed ACS 

Aurora 2 
(Satcom C5) 

5/29/1991 

6/1991 

Total Loss 

Motor fault 

Clementine 

1/25/1994 

5/1/1994 

Partial Loss 

Computer malfunction caused spinup and loss of fuel 

Deep Space 1 

10/24/1998 

7/1999 

Partial Loss 

Target tracking problem due to software 

Early Bird 

12/24/1997 

12/28/97 

Total Loss 

GPS unit shorted due to bus draining batteries 

EchoStar 5 

9/23/1999 

7/1/2001 

Mission Interruption 

One of three momentum wheels fails 

FUSE 



Mission Interruption 

Second of four reaction wheels fails 




Total Loss 

Catastrophic attitude control failure due to SCP 
malfunctions 


12/8/97 

9/1/2000 

Shortened Life 

Three of four xenon ion thrusters fail. 


2/10/1998 

3/1998 

Mission Interruption 

GPS receivers fail. 


5/23/1995 

7/7/1998 

Total Loss 

Taken out of service due to noisy pointing caused by 
lubrication starvation of momentum wheels. 


8/2/1990 

5/10/1996 

Total Loss 

Reaction wheel failure 

Hotbird 2 

11/21/1996 

12/31/1996 

Shortened Life 

Fuel tank leak; Apogee transfer anomaly 

HST 

4/1/1990 

nSBES 

Mission Interruption 

Fourth of six gyros fails 

iSSEEMU 

3/1/1997 

fcgEHMB 

Mission Interruption 

Ground command error caused uncontrollable spin 

fSSSSSM 



Total Loss? 

Attitude control and propulsion system failure 

BSS5SHHH 


SSJSIMi 

Total Loss? 

Attitude control and propulsion system failure 

OEIffiSHHBi 

■3QMSHH 


Total Loss? 

Failure in orbit - fuel depletion 

■SKSHH 

5/5/1997 

5/5/1997 

Mission Interruption 

Faulty wheel electronics. 

Iridium 1 1 

6/18/1997 

6/18/1997 

Mission Interruption 

Faulty wheel electronics. 

Iridium 27 

9/14/1997 

9/14/97 

Total Loss 

Thruster anomaly depleted operational fuel 

Iridium 42 

12/8/1997 


Mission Interruption 

Wheel tachometer failure 

Landsat 6 

10/5/1993 


Total Loss 

Hydrazine manifold rupture; failure to reach orbit; 
Satellite exploded when pyrovalve was fired, igniting 
adjacent mixture. 

Lewis 

8/23/1997 

8/26/1997 

Total Loss 

Design error in ACS; failure to monitor spacecraft 
during initial operations 

Mars Climate 
Orb iter 

12/11/1998 


Total Loss 

Failure to use metric units in ground software trajectory 
models 

Mars Observer 

9/1/1992 


Total Loss 

Probably due to Propulsion System rupture or power 
short, induced by oxidizer leaking past check valves. 

NEAR 

2/17/1996 


Mission Interruption 

Main engine fuel bum malfunction due to on-board 
software limits being exceeded 


7/3/1998 


Mission Delay 

Consumed more fuel than expected during Earth 
swingby. Mars insertion delayed until Dec 2003 or early 
2004. 

Solar A 

8/30/1991 

i_ 


Safe mode during solar eclipse, unexpected spin, loss of 
control 

STEPO 

3/13/1994 

7/19/1994 

Mission Interruption 

IMU (gyro) fails 

STEP 2 

5/19/1994 

5/19/1994 

Performance Loss 

Noisy earth sensor affects pointing accuracy 

Telstar 402 

9/9/1994 


Total Loss 

Propulsion System pyrovalve firing caused explosion 

Terriers 

5/18/1999 

5/18/1999 

Total Loss 

ACS polarity error controlling magnetic torquer coil 
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The time of occurrence of satellite anomalies within their design life was 
investigated. Figure 5 illustrates when satellites were observed to fail for all anomalies, 
and those involving GN&C. In this figure, an anomaly was counted only if the satellite 
completed its design life by the end of 2002, or would have if the anomaly did not occur. 
It can be seen that the majority of anomalies (48% of all, 56 % of all GN&C) occur within 
10% of the mission design life. 



Figure 5 Anomaly Occurrence in Satellite Design Life 


Figure 6 shows the time relationship of cumulative anomalies as a function of 
mission day, for both all anomalies and GN&C anomalies. It is interesting to note that 
the slope is not equal to 1, which would be expected if satellites exhibit constant anomaly 
failure rates. It can be seen that a large number of anomalies are observed on the first day 
of the mission. After reaching 10% of a satellite design life, the anomaly failure rate 
declines precipitously and continues to decline thereafter. 



0 12 3 4 
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Figure 6 Cumulative Anomalies vs. Mission day 

Mishap rates as a function of launch year, mission category and orbit category 
were investigated. Mishap rates shown in the following figures are for all anomalies 
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recorded, using the total mission population whether or not the mission has completed its 
design life. Figure 7 illustrates the mishap rate distributed by year launched. The mishap 
rate over 1990 through 2001 appears to be fairly constant, especially when considering 
that the satellites launched later have not yet achieved their design life, making their 
status as success or failure as yet undetermined. The mishap rate due to GN&C 
anomalies is fairly constant as well, although it appears that GN&C anomalies have fallen 
recently, with no GN&C anomalies reported for satellites launched in 2000 or 2001. 
Although mishap rates observed are fairly constant, the number of reported anomalies has 
increased dramatically since 1997 due to the large number of satellites launched in 1997 
through 2000. 


1990 - 2001 On-Orbit Satellites 
(US, Europe, Canada, Japan) 



Year Launched 


Figure 7 Mishap Rate vs. Year Launched 


Figure 8 shows the mishap rate distributed by mission type. It can be seen that a 
large variation in mishap rate exists for various mission types. In general, mission types 
with a large number satellites (communications and military) have a lower mishap rate 
than missions types with few satellites launched (deep space), which is as expected. 

Deep space missions have very high mishap rates when compared to other mission types, 
and the GN&C contribution to these anomalies is very high. The high mishap rate may 
be explained by the inherent complexity of deep space missions. Deep space missions 
require high levels of autonomy and have limited communication time with the ground. 
In addition, the deep space environment is not as well characterized as for other mission 
. types. Military missions have slightly lower mishap rates than expected when comparing 
to other mission types; this can probably be explained by under-reporting of anomalies 
for military missions. Technology missions are seen to have a low GN&C mishap rate 
when compared to their total mishap rate; this may be explained by the fact that 
technology missions by their nature have higher mishap rates due to their usually 
complex technology payload rather than due to any satellite bus subsystem. 
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1990 - 2001 On-Orbit Satellites (US, Europe, 
Canada, Japan) 



Figure 8 Mishap Rate vs. Mission Type 


Mishap rates distributed by orbit also show variations depending upon the orbit 
category. Figure 9 shows that GN&C anomalies make up a rather large percentage 
(roughly one third) of LEO anomalies compared with GEO anomalies; this can be 
attributed in part to the large number of EPS problems that GEO communication 
satellites have exhibited recently. The average power level of GEO communication 
satellites launched from 1996 through 2001 has tripled 1 , which has resulted in an increase 
in EPS technical complexity. It can also be seen that the GN&C contribution to 
anomalies in heliocentric orbit is very large; this may be partly explained by the fact that 
heliocentric missions cannot rely on magnetic control and require a propulsion system, 
whereas this is not the case for LEO missions. The large percentage of GN&C anomalies 
can be also attributed to the difficulty of getting to a heliocentric orbit. Curiously, the 
few spacecraft that are in planetary orbits have not had GN&C anomalies. Missions in 
heliocentric orbit have the highest observed mishap rate. 



Figure 9 Mishap Rate vs. Orbit 
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Figure 10 shows the GN&C failure categories observed. It can be seen that the 
largest number of GN&C anomalies can be attributed to hardware problems, although 
hardware and design problems have almost an equal contribution if just considering 
anomalies that resulted in total loss. Design problems are the next major cause category 
for GN&C anomalies. All anomalies categorized as verification were ACS polarity 
errors. 



Figure 10 GN&C Anomalies vs. Cause Category 


Figures 1 1 shows GN&C anomalies categorized by equipment type. Not all 
GN&C anomalies have an obvious associated equipment type (e.g., an ACS polarity 
problem with the magnetic system was not given an equipment category). It can be seen 
that the largest number of GN&C anomalies are attributed to reaction wheel failures. 
Pyrovalve induced anomalies have been a problem for both propulsion system 
applications as well as payload applications, and tend to result in total loss of mission. 
Pyrovalves by themselves are reliable, but in these cases the adjacent systems have not 
been able to withstand the mechanical or electrical shock generated by the pyrovalve. A 
number of anomalies have been caused by faulty processor operations. A number of gyro 
failures have occurred, but many of them have occurred after the satellite design life was 
reached so were not counted in this analysis. A number of missions have recently 
developed gyro-less attitude determination software, so gyro failures now tend to result in 
mission interruption or performance loss instead of total failure. It is interesting to note 
that no anomaly records were found involving star trackers; it appears that most star 
tracker anomalies can be also solved with software uploads. 
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Figure 11 GN&C Anomalies vs. Equipment Type 


CONCLUSION 

A study of past on-orbit anomalies was undertaken to asess how future satellite 
program resources might be best spent to ensure mission success. Spacecraft anomaly 
trends were surveyed over the last decade, with the hope of learning ways to improve the 
process of GN&C system development, to reduce the failure rate of future missions. One 
conclusion that was apparent during the data survey was that industry-wide data is not 
shared on a routine basis. It is difficult to leam from history if anomaly records are kept 
out of the public domain. 

As expected, most anomalies were observed to occur early in the mission. This 
indicates that design flaws and latent manufacturing defects have a greater effect on 
mission success than materials contamination or fatigue/overstress. The standard 
spacecraft integration and test process already invests significant effort to expose design 
flaws and physical defects before launch. The fact that some mission critical faults get 
through shows that this effort is not excessive. Is more testing needed? Not necessarily; 
other studies have drawn a correlation between parts failures and stress due to excessive 
testing. It is recommended, however, that testing be done in as flight-like a configuration 
as possible (e.g. flight harnesses for polarity tests), and that all test results be understood. 
This may seem obvious, but history shows that test anomalies have been overlooked, 
only to be found in review of test data after an on-orbit failure. 

An exception to the trend of anomalies occurring early in the mission is wheel 
anomalies. Wheel anomalies tend to occur later in the mission, which suggests that 
mechanical wear-out is an increasingly significant factor. Since wheel anomalies are the 
most common GN&C failures, the most significant reduction in GN&C failures may be 
realized by improving wheel reliability over time. 
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Aside from wheels, the most troublesome GN&C components appear to be 
pyrovalves. While the pyrovalves themselves are reliable, they are apparently easy to 
misuse, leading to catastrophic damage of other components. This is counted as a design 
flaw, not of the pyrovalve but of the system that employs it. The mechanical and 
electrical interactions of the pyrovalves with surrounding systems must be thoroughly 
understood. 

Many recent anomalies have been caused by EPS problems associated with solar 
and battery anomalies. It is apparent that the increase in technical complexity and design 
lifetime for GEO communication satellites has increased the risk of failure in this 
subsystem. 

Deep space mission and missions in heliocentric orbits have very high mishap 
rates when compared to other types, and the GN&C contribution to these anomalies is 
very high. The GN&C effort for these missions is inherently more technically complex 
due to the complex orbit trajectory requirements, the need for high levels of autonomy 
and their dependence on propulsion systems. 
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